Security Analytics

Real-Time Cybersecurity Threat Detection

Correlate security event streams from logs, network traffic, and authentication systems using SQL. RisingWave surfaces threat patterns within milliseconds, without the batch processing delays of traditional SIEM pipelines.

Start FreeReal-Time Alerting
Sub-Second
Threat Detection
Security event streams evaluated continuously against threat patterns, surfacing intrusions within milliseconds of the first indicator of compromise
SQL
Correlation Engine
Express MITRE ATT&CK-aligned detection rules as SQL window aggregations over log and event streams without custom correlation code
Multi-Source
Event Correlation
Correlate network traffic, authentication logs, endpoint telemetry, and DNS streams in a single SQL threat detection rule
PostgreSQL
SIEM Integration
Feed enriched threat signals to downstream SIEM, SOAR, and ticketing systems via standard PostgreSQL protocol

Why Streaming Detection

Why does threat detection require streaming event correlation?

Batch-based SIEM systems index logs after collection, introducing minutes or hours of detection latency. By then, an attacker has completed lateral movement or exfiltrated data. Streaming event correlation evaluates threat patterns against every security event as it arrives, enabling detection at the speed of the attack.

FactorTraditional SIEMRisingWave
Detection LatencyMinutes to hours (batch index)Sub-second (streaming)
Correlation LogicSPL/KQL queries on indexed dataContinuous SQL over live streams
InfrastructureLog shipper + SIEM clusterSingle SQL system
Multi-Source RulesSeparate collection pipelinesUnified SQL joins across sources
  • →Detect indicators of compromise within milliseconds of the first event rather than after the next SIEM index cycle
  • →Express multi-stage attack patterns as SQL window aggregations over correlated event streams
  • →Correlate authentication failures, privilege escalation, and network anomalies in a single SQL rule
  • →Reduce SIEM infrastructure costs by pre-aggregating and enriching events before indexing

Use Cases

What threat patterns does streaming event correlation detect?

Any attack pattern that produces a sequence of detectable events across security log streams. Brute force attempts, lateral movement, privilege escalation, and data exfiltration all leave correlated event traces that SQL window aggregations can detect as they unfold.

Brute Force and Credential Stuffing

Detect authentication failure velocity exceeding threshold per user or IP within rolling time windows using SQL COUNT aggregations over authentication event streams from Okta, Active Directory, or custom auth systems

Lateral Movement Detection

Correlate authentication events across multiple internal hosts within time windows to identify lateral movement patterns, joining authentication logs with network topology data to flag unusual access paths

Privilege Escalation Monitoring

Alert when standard user accounts perform privileged operations by joining live authentication streams with role and permission tables updated via CDC, detecting escalation within seconds of the first privileged action

Data Exfiltration Signals

Surface unusual outbound data volume, access to sensitive file paths outside normal working hours, or bulk database queries by correlating network flow, file access, and database audit log streams in a single SQL rule

How It Works

How does RisingWave correlate security events for threat detection?

RisingWave ingests security event streams from Kafka log pipelines and continuously evaluates SQL-defined detection rules using materialized views. Threat signal state, including failure counts, accessed hosts, and query volumes, is maintained as incrementally updated SQL results. Your SIEM, SOAR, or alerting system queries or subscribes to the threat materialized view, receiving enriched detections ready for analyst review.

  • →Create Kafka sources in RisingWave pointing to your log event topics (auth logs, network flows, endpoint telemetry) using SQL CREATE SOURCE statements
  • →Define threat detection rules as SQL materialized views with window aggregations correlating events across sources
  • →Enrich detections by joining event streams with asset inventory, user context, and threat intelligence tables via stream-table joins
  • →Query the threat materialized view from your SIEM or SOAR platform to ingest pre-correlated, enriched detections
  • →Add new detection rules by writing SQL SELECT statements over existing source streams without pipeline restarts

Frequently Asked Questions

How do I build a real-time threat detection pipeline using streaming data?
How does streaming threat detection compare to a traditional SIEM?
How does RisingWave compare to Apache Flink for security event processing?
How do I integrate threat detections with my existing SIEM or SOAR platform?

Detect threats at the speed of the attack

Correlate security event streams in SQL and surface threat patterns within milliseconds, without the batch delays of traditional SIEM pipelines.

Start Free
Best-in-Class Event Streaming
for Agents, Apps, and Analytics
Start Free
SlackJoin our Slack
GitHubXLinkedInSlackYouTube
Sign up for our to stay updated.